Missing permission (scope) from the token if the user has more then 53

[rczjns]

Hi All,

I run into a weird issue. We have multiple microservices so we have several permission (scope) in our APIs. If a user get all of the permission (like a Super Admin) and I check the scopes in the token I’ll see only the first 53 scope. Scopes are in alphabetical order and I just get the first 53 scopes.. I’ve tried to add more and nothing changes (only 53). If I reduce the number of the scopes everything is fine.

Has anyone else run into this issue? Any idea about that? Or could someone confirm me this issue? Thanks in advance!

[dan.woda]

Hi @rczjns,

Welcome to the Community!

From what I can find, there shouldn’t be a limit on the number of scopes per se, but you may run into token size limit from the browser.

Take a look at this post that talks about a similar scenario:

Limit for number of scopes per API

Hi @j.makishi. There’s no documented limit for the number of scopes that you can add to an API definition. If the scopes you are providing will be dynamically requested/added and you don’t need a consent for them, you can add a scope in a rule without it being previously defined for the API. In terms of the number of scopes that can actually be included in a token, you might be bound by the size of the JWT token when used in the Authorization header (the HTTP protocol doesn’t define any limit …